How should banks design CIAM journeys to reduce fraud without creating friction for legitimate customers?

Why This Matters for Security Teams

ciam in banking is not just about making sign-in “easy.” It is where fraud controls, customer experience, and regulatory pressure collide. If journeys are too strict, legitimate customers abandon onboarding or payment flows. If they are too loose, attackers exploit account recovery, device change, and step-up gaps to take over accounts or open mule pathways. NIST SP 800-53 Rev. 5 frames the broader control expectation around identity proofing, access enforcement, and monitoring, but banks still have to tune those controls to the real customer journey.

This is especially important because identity fraud often hides inside normal-looking activity. A weak recovery flow or inconsistent step-up trigger can be enough to defeat otherwise strong authentication. NHIMG research shows that identity failures are usually operational, not theoretical, and the Ultimate Guide to NHIs also highlights how weak governance and excessive privilege turn small mistakes into larger compromise paths. In practice, many security teams discover friction problems only after abandonment rises or fraud losses have already accelerated, rather than through intentional journey testing.

How It Works in Practice

Effective banking CIAM uses layered decisions rather than a single hard gate. The core idea is to apply stronger checks only when the risk justifies them, while keeping low-risk journeys fast. That means combining device intelligence, behavioural signals, velocity checks, geo- and session anomalies, and identity proofing results into a runtime decision. NIST SP 800-53 Rev. 5 Security and Privacy Controls supports the underlying control logic for authentication, access enforcement, and monitoring, but the customer experience depends on how those controls are orchestrated.

Practically, banks should design three things well:

• Progressive trust, where the user starts with minimal friction and earns lower-friction access as assurance increases.
• Risk-based step-up, where challenges are triggered by signals such as new device use, risky IP reputation, failed recovery attempts, or suspicious payee changes.
• Recovery hardening, where password reset, device rebind, and profile updates are treated as high-risk journeys, not convenience paths.

For fraud reduction, the most effective journeys also reuse signals across channels so a suspicious mobile login can influence web transfer approvals, and vice versa. That is where orchestration matters more than any single control. A bank that treats onboarding, login, recovery, and high-risk transaction approval as separate silos will miss patterns that span the full customer lifecycle. NHIMG’s 2024 Non-Human Identity Security Report shows that 88.5% of organisations say their non-human IAM practices lag human IAM, which is a useful reminder that identity maturity gaps are usually systemic rather than isolated.

These controls tend to break down in high-volume, multi-channel banking environments because inconsistent signal quality and legacy core integrations make real-time risk decisions unreliable.

Common Variations and Edge Cases

Tighter fraud controls often increase abandonment and support load, requiring banks to balance conversion against loss prevention and regulatory obligations. The right design is rarely “more MFA everywhere.” Current guidance suggests adapting friction to context, but there is no universal standard for the exact thresholding model yet.

High-risk account recovery is the clearest edge case. If a customer has lost a device, forgotten credentials, and changed contact details, the flow must be strict enough to resist takeover while still offering a viable path to regain access. Another edge case is vulnerable customers, where banks may need alternate step-up methods that are accessible and usable without weakening assurance. For operational resilience, recovery logic should be tested against real attack patterns such as social engineering, SIM swap, and help-desk impersonation, not just password guessing.

Banks should also watch for “false smoothness.” A journey that almost never challenges users may look good on UX metrics while silently giving fraudsters a predictable path. NHIMG’s Emerald Whale breach and TruffleNet BEC Attack — Stolen AWS Credentials both reinforce the same lesson: once identity assurance fails, attackers move quickly into higher-value actions. Best practice is evolving toward adaptive, risk-scored journeys, not static authentication rules that apply the same way to every customer and every event.

Related resources from NHI Mgmt Group

• How should banks reduce authorised push payment fraud without creating excessive friction for legitimate customers?
• How should security teams reduce online payment fraud without creating excessive friction for legitimate customers?
• How should security teams reduce CIAM procurement friction without creating new governance gaps?
• How should businesses build transaction monitoring programs that reduce fraud without creating too much friction for legitimate users?